Advanced Galileo in-Orbit Validation Constellation Simulations
This paper describes a training- andcertification-based simulation concept embedded in the overlaid training process as analternative to the classical operational validation concept. The extraordinary setup of thefirst In-Orbit Validation (IOV) spacecraft handover simulation required to train the criticalcontrol handover from one control center to another is presented.
Content
Advanced Galileo In-Orbit Validation Constellation
Simulations
Andreas O. Kohlhase 1 and Michelangelo Ambrosini 2
DLR GfR mbH, Galileo Control Centre, 82234 Wessling, Germany
Petr Shlyaev 3
LSE Space Engineering & Operations AG, European Space Operations Centre, 64293 Darmstadt, Germany
and
Jasmina Brajovic 4
DLR GfR mbH, Galileo Control Centre, 82234 Wessling, Germany
We have experienced successful launch of Europe’s first two GALILEO satellites Thijs and
Natalia on October 21, 2011 and the effectual completion of the first In-Orbit-Test phase.
Now, about 5 months later, changing requirements impose the definition of a training and
certification process that accounts for different training needs, system knowledge and
operational experiences of staff members and trainees. This paper describes a training- and
certification-based simulation concept embedded in the overlaid training process as an
alternative to the classical operational validation concept. The extraordinary setup of the
first In-Orbit Validation (IOV) spacecraft handover simulation required to train the critical
control handover from one control center to another is presented. Finally, lessons learned
gained from first post-handover IOV operations are discussed to propose advanced IOV
simulation concepts. A timeline for an advanced inter-control-center and dual-spacecraft
simulation is presented as a first step towards full constellation flight simulations involving
multiple control centers or sites. Considering network and infrastructure failures in future
contingency constellation simulations will better prepare and qualify operations and hosting
teams for real contingency operations. Automation of routine task activities will make the
preparation of future constellation simulations more time- and cost-effective.
Nomenclature
m
n
k
T0
d
G
=
=
=
=
=
total number of simulations
simulation number
number of certification simulations
simulation start in GST
day
I. Introduction
ALILEO is Europe’s program for a Global Navigation Satellite System (GNSS), providing a highly accurate,
guaranteed global positioning and timing service. The complete GALILEO constellation will consist of 30
satellites in three orbital planes at an angle of 56 degrees to the equator. With the satellites taking about 14 hours to
orbit Earth at altitudes of 23 222 km, there will always be at least four satellites visible anywhere in the world1.
The IOV phase is the first of three incremental implementation steps or mission phases to develop the GALILEO
System and to validate its in-orbit performance. The Full Operational Capability (FOC) phase will deploy in full the
1
GCC-D Operations Training Manager, Operations Department, [email protected]
GCC-D Simulation Officer, Operations Department, [email protected]
3
LOCC-D Simulation Officer, ESA HSO-ONX, [email protected]
4
GCC-D Planning Engineer, Operations Department, [email protected]
1
2
ground and space infrastructure as required to achieve
full operational capability. The purpose of the final
Exploitation phase is to operate the FOC
infrastructure and to provide navigation services over
the entire system lifetime. The core system
components are the Space Segment (SSEG) including
launch services, the Ground Control Segment (GCS)
and the Ground Mission Segment (GMS). The GCS is
operated by the DLR Gesellschaft für Raumfahrtanwendungen (GfR) mbH as a company of the
German Aerospace Center DLR, having its seat at the
Galileo Control Center (GCC-D) in Oberpfaffenhofen. The GMS is situated in Telespazio’s Galileo
Control Center (GCC-I) in Fucino.
In addition to the ground segments, support
facilities have to be available as they are fundamental Figure 1. Predicted 3-dimensional view of the IOV confor the deployment, validation and maintenance of the stellation flight for an epoch on November 8, 2012 after
GALILEO system. Launch and Early Operations completion of the drift manoeuvre for FM3 and FM4
(LEOP) Control Centers (LOCCs) at CNES in
Toulouse and ESOC in Darmstadt are required for providing LEOP service for all satellites of the GALILEO
constellation. An In-Orbit Test (IOT) Station in Redu (B) is setup for providing a means to test the satellite functions
and performance after launch and separation.
The IOV constellation consisting of only 4 satellites will provide the capability of broadcasting globally a set of
navigation signals and other navigation data supporting a number of services. The IOV constellation depicted in Fig.
1 is thus the first step towards the final FOC constellation of 30 satellites. On October 21, 2011 the successful
launch of the first two GALILEO satellites Thijs (PFM) and Natalia (FM2) took place initiating the IOV phase. About
4 months later, the IOT campaign of both satellites was successfully accomplished at GCC-D.
The training of personnel for the first launch (L1) was based on a Training Need Analysis (TNA) provided by
the customer. The main objectives of the L1 simulation campaigns were to train and validate personnel for all
operational phases as well as to validate systems and interfaces. After the L1 IOT campaign, the training plan had to
be revised according to changing training needs and requirements imposing a more certification-based training
approach. The following section suggests a possible GCC training and certification process.
The described activities are carried out under a contract via Spaceopal GmbH within a program of and funded by
the European Union. The views expressed in this paper can in no way be construed as reflecting the official opinion
of the European Union and/or of the European Space Agency.
II. The Proposed GCC Training Process
To develop and propose an appropriate GCC training process several post-launch (L1) requirements have been
taken into account from which the most important ones are: (i) Changing task-, team- and role-based training needs,
(ii) Refresher or recurrent training for experienced and qualified engineers to maintain qualification/certification,
(iii) Possibility of cross- and re-certification, (iv) Flexibility regarding training methods and time slots to account for
changing resource constraints, trainee and trainer availability, (v) Assessment of trainees to measure their system
knowledge and qualification progress by means of written or verbal tests and assessment reports, (vi) Simulation
campaign as the last training method to validate, qualify or certify personnel for real operations, and finally (vii)
Trainers are assumed to have appropriate training skills and expertise in their training subjects.
Based upon these requirements, a multi-level training approach with three different training process entry levels
has been developed. The proposed process is depicted in Fig. 2. The core process starts with the Cat 3 trainee – new
employee – who has to go through the whole training curriculum from Level I to IV to achieve the required level of
skills and knowledge for certification. So-called training and simulation participation matrices assign roles and
trainees to Level I – III courses so that every candidate knows which course she or he has to take. Waivers may be
requested for certain training courses if the Cat 3 trainee can prove knowledge and/or former operations experience.
Recurrent and delta training as well as training for supporting teams like IT and network operations support is
captured by training side processes. If cross-certification is desired the Cat 1 trainee has to step in again on Level II
of the process. In case of cross-certification within the Flight Operations team the Cat 1 trainee can directly start
with Level III training. The process has to be re-started ~ 7 months prior to each launch assuming a training period
2
Figure 2. The proposed GCC multi-level training process with its three different training process entry
categories accounting for different training needs, system knowledge and operational experience of trainees.
The process is planned to be re-started ~ 7 months prior to each launch assuming a training period of ~ 6
months.
of ~ 6 months and 2 launches per year. In the following, scope and purpose of the training levels are described in
more detail.
Level I
Level I is the GALILEO system overview training with GCS and GMS introductory courses. It is applicable to all
newcomers regardless of their role and task. For this reason, Level I training shall be organized in a 3- or 4-day
block with theoretical presentations done by the trainers. This approach allows trainees to socialize with each other
and experts to refresh basic system knowledge. A multiple choice test has to be successfully answered for each
introductory course as qualification for the next training level. On-the-Job Training (OJT) already starts during or
after Level I training sessions and is continued throughout the training process. A training mentor creates a list of
tasks to be performed by the team. This list will be used to create a so-called score card in which the trainee’s OJT
tasks are scored. Each time an experienced engineer judges that the trainee is proficient on a task, that engineer signs
off the score on the trainee’s score card.
Level II
Level II is meant to be the operations specialist training consisting of task- and role-specific training courses for
GCS and GMS teams like the Flight, Ground and Mission operations teams. Level II training shall be done as selflearning combined with practical exercises. In case of multiple needs from trainees of different teams, a classroom
presentation can be setup. A multiple choice test has to be successfully answered for certification-relevant courses as
qualification for the next training level. Practical exercises will be assessed by the trainer, complemented by
discussion with the trainee team.
Level III
Level III is an intermediate training level devoted to the Flight Ops team only. This level covers satellite subsystem
training and is supposed to be done by self-learning. A subsequent verbal assessment by the training mentor will
qualify the trainee for the final simulation campaign. The trainee has to answer to a questionnaire with open
3
questions. Initial subsystem training will be provided by SSEG in case of a new satellite system. Subsequent
assessment is done by multiple choice tests provided by the manufacturer
Level IV
Level IV is the simulation training for final qualification and certification. The successful accomplishment of all
previous training levels is a prerequisite. The objective of this approach is to assess and certify system
knowledge/system matter expertise, to assess and certify operational skills and awareness for nominal and
contingency operations under realistic conditions. The simulation officer will assess the performance in a final
certification simulation related to specific objectives defined in the certification profile. The number of certification
simulations k and which simulation will be a certifying one depends on certification needs of personnel. The
assessment report is the most important reference for final evaluation in the Certification Board (CB) meeting. If a
trainee has failed her or his certification simulation the CB has to decide if the candidate has to do another
certification simulation or repeat the training starting from Level II (see Fig. 2).
A simulation campaign can also be seen as a main validation step of a mission operational validation approach.
The system simulator is the prime data source for ground segment validation testing, for staff training and for
exercising the complete ground system in a predefined series of simulations prior to launch2. The system simulator
is also required as a means of validating operational procedures. As already mentioned in the introduction, this
approach has been mainly applied to the L1 training and simulation campaign. However, FOC simulation campaigns
will have to focus on training and certification of personnel. Additional system and operational product validation
needs will be covered by delta training, i.e., delta systems and Flight Operations Procedure (FOP) validations
performed by qualified operations experts (see Fig. 2). For systems and FOP validation purposes, the simulation
officer normally setup dedicated validation simulations. For the L2 simulation campaign, it is planned to combine
training-relevant with validation-relevant simulations to keep up with the pace of the project. A training and
validation simulation can be further used to create training relevant S/C configurations for breakpoint generation.
That reduces the time effort to prepare simulations.
III. Simulation Planning and Execution Approach
LOCC and GCC simulation campaigns validate, qualify or certify trainees and teams for the satellite operational
phases shown in Fig. 3. The simulation plans provided by the simulation officers of each center prior to each
simulation campaign defines the total number m of
simulations, the scenarios
and the schedule required
to train and validate their
personnel. In case of a new
satellite system, the entire
Flight Operations team has
to be certified for opera- Figure 3. The GALILEO operational phases with single, dual- and multi-center
ting the new satellites, operations
meaning that Flight Ops
team members have to re-start the training process on Level III (see Fig. 2). The LOCC flight operation team needs
to be re-trained and re-validated for the critical LEOPs of the next launches as well, especially for L3 although
certification is not required.
The sequence for a simulation n within the simulation campaign is divided in three major phases: Phase I –
simulation preparations, Phase II – simulation execution and Phase III - simulation follow-up work. The flow or
process is presented in Fig. 4.
Phase I
In order to prepare a simulation the first step is to choose the simulation type. The following multi-control-centre
simulation types are considered:
1.
Joint GCC-D and IOT station simulations, also referred to as inter-site simulations
4
Figure 4. The applied simulation planning and execution sequence for a stand-alone or multi-control-center
simulation n with its three distinct phases: I – preparations, II – execution and III – follow-up work. The
simulation campaign is accomplished when the total number of planned simulations m is reached.
2.
3.
4.
Joint GCC-D and GCC-I simulation, also referred to as GCC inter-control-centre simulation
Joint LOCC and GCC-D simulation, also referred to as LOCC/GCC inter-control-centre simulation
Stand-alone simulation
LOCC simulations only consist of types 3 and 4 whereas GCC-D simulations consist of all types. GCC-I and IOT
station personnel is only remotely involved since these centres do not have their own simulators. Single-centre
operations are always trained through stand-alone simulations. Training for dual-centre operations considers standalone and inter-control-centre simulations. Platform (PF) commissioning scenarios are trained in stand-alone
simulations at GCC-D whilst LEOP scenarios are trained in stand-alone simulations at LOCC. Control handover and
special operations like the drift stop manoeuvre are typical scenarios for joint LOCC/GCC inter-control centre
simulations. The drift manoeuvre is started in LEOP. During the satellites’ drift to its target position within the
orbital plane the LOCC and GCC-D still exchange Flight Dynamics (FD) products until official FD handover after
Payload (PL) IOT. PL and secure IOT operations require multi-control-centre operations, thus the involvement of all
4 centres LOCC, GCC-D, GCC-I and the IOT station but not necessarily at the same time. Training is therefore
performed through alternating inter-site or inter-control-centre simulations. Routine contact scenarios are trained in
the framework of GCC inter-control-centre simulations, thus as a joint GCC-D/GCC-I simulation.
Every simulation type requires pre-configurations and definitions, i.e., a scenario description, general
information, initial spacecraft (S/C) and environment configurations, participating trainees and teams, ground
elements and infrastructure setup as well as an activity timeline. S/C systems and environment are configured on the
simulator by the simulation officer and saved as a so-called “breakpoint” that is a huge data vector containing the
status of all modelled parameter for a certain simulated epoch. The detailed Sequence of Events (SoE) is created by
the planning team based on the simulation plan provided by the simulation officer. The SoE mainly lists all events
and activities to be executed for a satellite in a chronological order and with procedure references. The overall
timeline can then be visualized in the training or control room as a Gantt chart, also highlighting ground station
visibilities and contact durations. The entire configuration is described in a simulation book at GCC-D and in a
briefing note at LOCC. In case of a contingency simulation, the simulation officer has to define failure cases and to
eventually test them on the simulator. To do so she or he restores the breakpoint, sets the simulator in run mode and
injects available failure commands and tests them especially regarding Failure Detection, Isolation and Recovery
(FDIR) reactions.
About 7 days prior to starting the simulation session, the simulation officer releases the simulation book or the
briefing note and invites the participating personnel. In case of multi-control-centre simulations, a joint simulation
book or briefing note is the preferred solution. About 2 days before simulation start, the simulation officer checks
the initial S/C configuration together with Flight operations team member and trainees by restoring the breakpoint
and setting the simulator in run mode. In case of deviations, the simulation officer adjusts the breakpoint and saves it
again. Typical deviations are missing TM packets or a wrong S/C unit configuration.
5
Phase II
The simulation day normally starts with the setup and configuration of the simulator for which the support of the
ground team is required. Especially for time-tagged commanding in routine contact or manoeuvre simulations the
system time has to be synchronized with the simulated epoch which is normally in the future. This requires a time
configuration of the S/C monitoring and control system. Meanwhile, the training room infrastructure is configured
by the hosting team to display the Gantt chart, S/C monitoring and control events and times on special screens. A
short briefing is done in the training room in which the simulation officer briefly describes scenario, training
objectives, important events and the initial S/C configuration. In case of multi-control-center simulations, a joint
briefing is performed on the corresponding voice loop. After the briefing, the trainees prepare their consoles for the
simulation. At T0, the simulator is set in run mode and the start of the simulation is announced via the operations
voice loop. After simulation end, the simulation officer normally invites the team to a de-briefing to discuss
observations, simulated or real anomalies, change requests and learning effects.
Phase III
The follow-up work is to analyse all raised observation reports, change and planning requests. These reports and
requests are tracked in the anomaly tracking tool in which special GCC projects are available for simulation and
training purposes. Based upon the simulation observations reports, planning and change requests as well as
debriefing and personal notes, the simulation officer writes and releases the simulation report containing the
performance assessment of trainees and teams w.r.t. training and certification objectives.
In the following section, the configuration of the LOCC/GCC inter-control-centre simulation will be explained in
more detail since the control handover is considered as a critical phase in which satellites are handed over from one
control entity to another one and requiring a special setup.
IV. The joint LOCC-GCC Control Handover Simulation
In order to handover the control of a spacecraft from LOCC to GCC in a controlled and well-structured way the
handover phase has been split into the following sub-phases: (i) pre-handover, (ii) handover and (iii) post-handover
phase. The handover of a spacecraft from LOCC to GCC has always to take place in a joint pass that ensures that
both control centers have adequate duration, visibility and access to the spacecraft to complete the handover
activities. The pre-handover phase is devoted to joint FD activities like orbit determination whereas in the main
handover phase the GCC-D flight ops team takes over responsibility by sending first test and up-linking timetagged commands via the GCS ground stations. The handover phase is formally accomplished when the GCC-D
operations director signs
off a formal handover
report sent by the LOCC
operations director. The
purpose of the posthandover phase is to
archive the entire LEOP
Telemetry (TM) and Telecommand (TC) history provided by LOCC.
The main objectives of
the control handover simulation were to exercise the
interfaces between the
different teams, especially
between the flight operations and the FD teams,
and to validate operational Figure 5. Sketch of the proposed network setup for an inter-control-center
interfaces and handover simulation in which one simulator sends real-time TM data to the S/C controlling
operations. Interfaces are workstations of both centers and receives real-time TC data coming from both S/C
required for (a) real-time controlling workstations
6
TM and TC data transfer between LOCC and GCC, (b) near real-time TM flow from GCC to LOCC realized by
rapid file transfer, (c) FD data transfer from LOCC to GCC and (d) voice communication links. Rapid files contain
chunks of recorded TM. To transfer orbit information from LOCC to GCC and rapid files back to LOCC the
standard GALILEO data distribution network is used. For verbal communication between both centers dedicated
loops of the voice communication system are used. To train and validate all these interfaces as well as the handover
operations in a joint LOCC/GCC inter-control-center simulation the following constraints had to be taken into
account: Starting with identical initial S/C and thus breakpoint conditions, choosing a site in which GCS and LEOP
ground stations are very close to each other, and finally having an uninterrupted simulation run.
The requirement to transfer TM and TC frames in real-time and the other constraints imposed a special network
setup between LOCC and GCC-D in which only one simulator shall run the entire simulation. The simulator has to
send TM packets to the S/C monitoring control systems of both centres and has to receive TC packets coming from
both S/C control systems. Due to technical constraints and time synchronization issues the LOCC simulator had
been selected to run the joint simulation which required a re-configuration of the LOCC simulator such that it is able
to also model the selected GCS ground stations. The GCC-D S/C controlling system time had to be synchronized
with the LOCC S/C controlling system time running in the future. Fig. 5 depicts a sketch of a possible network setup
required for inter-control-centre simulations. To send simulated TM and receive TC packets to and from GCC-D the
LOCC simulator is connected via a so-called network control server to the data handling server in the GCC-D
training room where they are parsed or assembled. From there TM annotations, TM messages and TC
acknowledgements are unidirectional forwarded to a proxy server whilst TM and TC frames can only be routed bidirectional through a security element to and from the proxy server.
An alternative would have been a setup in which the GCC-D simulator takes over the control of the simulation
for example after the handover phase or even earlier. This would have implied a short stop of the simulation, saving
the breakpoint, sending it to GCC-D, restoring it on the GCC-D simulator and re-configuring the GCC-D S/C
monitoring and control system. This approach was deemed to be too risky and would cause an inacceptable
interruption of the simulation. However, it was deemed to be very useful for the stand-alone PF commissioning
simulations at GCC-D since the saved and transferred LOCC handover breakpoint allowed a seamless continuation
of further stand-alone PF commissioning simulations at GCC-D using the handover breakpoint as the initial PF
commissioning breakpoint.
V. Lessons Learned and Simulation Advancements
During the first IOV PF commissioning phase, a L1 simulation campaign retrospective meeting took place at
GCC-D to discuss lessons learned together with operation leaders, hosting engineers and simulation officers. This
section summarizes lessons learned from real operations having an impact on the definition and configuration of
future IOV and FOC simulations.
Integration of operationally used SoEs
L1 simulation timelines were derived from preliminary operations plans with rough activity descriptions. Some
activities could not be trained since operation procedures were still not available. The planning team manually
created a SoE based on the simulation plan and used a simple Gantt chart tool to visualize the SoE as described in
chapter 3. After entering to the routine phase for PFM and FM2, SoEs are now available that define proved
operation activities for both S/Cs starting from control handover up to routine phase. These timelines will be used to
define timelines for future IOV and FOC simulations making them more realistic.
Constellation flight operations concept
Nearly all L1 simulations were run with only one S/C. Current IOV operations already require the execution of
parallel activities for PFM and FM2. E.g., after the control handover of the second satellite, reduced routine
operations already had to start for the first satellite indicating that a full IOV and future FOC flight constellation will
have overlapping operational phases and the requirement to execute many activities in parallel. Discussions of
lessons learned gained from constellation operations of other missions state the training need for constellations
flights with multiple S/Cs3. To setup an advanced IOV constellation simulation the L2 simulation timelines will
have to consider constellation flight scenarios with 2 or even 4 S/Cs. A constellation simulator is available for the
L2 simulation campaign.
7
Figure 6. Gantt chart visualizing a proposed timeline for an advanced inter-control-center IOV simulation in
a dual-spacecraft constellation flight to train control handover and routine contact operations in parallel
Multi-control-center operations concepts
The GALILEO mission operations concept requires single-, dual- and multi-control-center operations to execute joint
activities in the different operational phases. Many of these activities and operational interfaces have been validated
in the L1 simulation campaign in the framework of the operational validation concept as described in chapter II and
are being proved in the on-going IOV mission phase. In a current human space flight mission personnel are trained
and certified in various joint simulations showing that multi-control-center training and operations is a state-of-theart approach4. However, a constellation flight simulation in an inter- or multi-control-center environment will further
advance the level of IOV simulations regarding FOC operational requirements. Fig. 6 proposes a dual-spacecraft
constellation scenario for an advanced inter-control-center IOV simulation to train control handover and routine
contact activities in parallel.
Contingency operations
In the L1 contingency simulations typical failures like TM loss, reaction wheel friction, heater line outage or a Save
Mode drop were triggered to train awareness and skills for recovery operations. In real operations network problems
occurred where the training had not been provided to support recovery actions. Future IOV and FOC simulations
will have to consider more hosting and infrastructure failures to better prepare and qualify operations and hosting
teams for real contingency operations.
Automation for constellation operations
A high degree of automation and autonomy is achieved using a number of novel tools that are integrated into a
coherent ground system to perform all required operations functions3. In the area of routine task execution, a new
multi-control-center mission planning approach will be applied in the near future to make use of automation
capabilities for command sequence generation and SoE execution5. The GCC planning facility will regularly create
so-called Short-Term-Plans (STP) based on a planning data base containing activity definitions and rules like ground
station visibilities. The planning facility will then send the STP to the S/C monitoring and control system that
automatically generates all required command sequences for all activities to be executed during the different
contacts. To create the command sequences the S/C control system refers to an internal procedure file archive. This
automated approach can be used to prepare and execute any future stand-alone or multi-control-center simulation:
The planning facility in the training room will create a STP-based SoE for simulation purposes based on activity
8
information provided by the simulation officer. It is assumed that the simulation timeline will always deviate slightly
from the real operation timelines stored in the planning database because operational products might not be available
or due to other resource constraints. The planning facility will then send the training STP to the S/C monitoring and
control system in the training room that automatically generates the command sequences for the simulation. The
current approach is that a S/C controller, a S/C operations engineer or a trainee has to manually create the command
stacks at the S/C monitoring and control system based on the provided STP-based SoE.
Inter-control-center communication
It has been experienced that in the first control handover and in the early post-handover operational phase
communication ways and methods were not elaborated. Future inter- or multi-control-center simulations and
operations require clear and documented communication rules.
VI. Conclusions
It has been demonstrated that the proposed GCC training process accounts for the evolving training needs and
resource constraints within the IOV mission phase. Simple certification guidelines have been presented which can
be implemented in the L2 training process on a very cost-effective basis. Training relies on highly skilled and
experienced trainers and training mentors being involved in real operations so that the recruitment of external
personnel is not required.
Combining purely training- and certification-based with validation-based simulations as a merged simulation
concept seems to be the preferred solution for the fast pace of the project. The merged concept expresses the IOV
specific transition from a validation- to a certification-based simulation approach.
The proposed timeline for the advanced inter-control-centre simulation includes overlapping operations phases
and parallel activities for two satellites making IOV simulations much more realistic and advanced w.r.t.
constellation flight and multi-control-centre operations. The configuration of the presented control handover
simulation can be used as a valuable reference for the setup of any other multi-control-centre simulation.
Future contingency simulations will have to consider more network and infrastructure failures to better prepare
and qualify operations and hosting teams for real contingency operations.
Utilizing the nearly automated command sequence generation approach will make the preparation of future
stand-alone and multi-control-centre simulations much more time- and cost-effective and clear communication rules
will optimize inter-control-centre communication during joint simulations and operations.
Appendix A
Acronym List
CB
CNES
DLR
ESOC
FD
FDIR
FM
FOC
FOP
GCC
GCS
GfR
GMS
GNSS
GST
ILS
IOV
IOT
LEOP
LOCC
Certification Board
Centre National d’Etudes Spatiales
Deutsches Zentrum für Luft- und Raumfahrt
European Space Operations Centre
Flight Dynamics
Failure Detection, Isolation and Recovery
Flight Model
Full Operational Capability
Flight Operations Procedure
Galileo Control Centre
Ground Control Segment
Gesellschaft für Raumfahrtanwendungen
Ground Mission Segment
Global Navigation Satellite System
Galileo System Time
Integrated Logistic Support
In-Orbit Validation
In-Orbit Testing
Launch and Early Orbit Phase
LEOP Operations Control Centre
9
OJT
PF
PFM
PL
S/C
SLE
SoE
SSEG
STP
TC
TM
TNA
On-the-Job Training
Platform
Proto Flight Model
Payload
Spacecraft
Space Link Extension
Sequence of Events
Space Segment
Short-Term Plan
Tele-command
Telemetry
Training Need Analysis
Acknowledgments
The authors would like to thank the customers ESA and Spaceopal and the entire GfR team for helpful
contributions and comments. Fig. 1 has been created using the commercially available AGI Satellite Tool Kit
software V9.0.
References
1
Kuhlen, H., Galileo Satellites, In: Handbook of Space Technology, 1st ed., John Wiley & Sons, Ltd, 2009, Chap. 8.6.
2
Warhaut, M., Spacecraft Operations, In: Handbook of Space Technology, 1st ed., John Wiley & Sons, Ltd, 2009, Chap. 6.1.
3
Bester, M., Lewis, M., Roberts, B., et al., “Ground Systems and Flight Operations of the THEMIS Constellation Mission,”
Aerospace Conference [online journal], URL: http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4526662&tag=1 [cited 25
April 2012]
4
Sabath, D. and Kuch, T., Operations for Human Space Flight, In: Handbook of Space Technology, 1st ed., John Wiley &
Sons, Ltd, 2009, Chap. 6.4.
5
Brajovic, J., and Fischer, H.-J., “The Challenges of a Multi-Control-Centre Mission Planning,” Space Operations
Conference, IAAA, Stockholm, 2012
10
Simulations
Andreas O. Kohlhase 1 and Michelangelo Ambrosini 2
DLR GfR mbH, Galileo Control Centre, 82234 Wessling, Germany
Petr Shlyaev 3
LSE Space Engineering & Operations AG, European Space Operations Centre, 64293 Darmstadt, Germany
and
Jasmina Brajovic 4
DLR GfR mbH, Galileo Control Centre, 82234 Wessling, Germany
We have experienced successful launch of Europe’s first two GALILEO satellites Thijs and
Natalia on October 21, 2011 and the effectual completion of the first In-Orbit-Test phase.
Now, about 5 months later, changing requirements impose the definition of a training and
certification process that accounts for different training needs, system knowledge and
operational experiences of staff members and trainees. This paper describes a training- and
certification-based simulation concept embedded in the overlaid training process as an
alternative to the classical operational validation concept. The extraordinary setup of the
first In-Orbit Validation (IOV) spacecraft handover simulation required to train the critical
control handover from one control center to another is presented. Finally, lessons learned
gained from first post-handover IOV operations are discussed to propose advanced IOV
simulation concepts. A timeline for an advanced inter-control-center and dual-spacecraft
simulation is presented as a first step towards full constellation flight simulations involving
multiple control centers or sites. Considering network and infrastructure failures in future
contingency constellation simulations will better prepare and qualify operations and hosting
teams for real contingency operations. Automation of routine task activities will make the
preparation of future constellation simulations more time- and cost-effective.
Nomenclature
m
n
k
T0
d
G
=
=
=
=
=
total number of simulations
simulation number
number of certification simulations
simulation start in GST
day
I. Introduction
ALILEO is Europe’s program for a Global Navigation Satellite System (GNSS), providing a highly accurate,
guaranteed global positioning and timing service. The complete GALILEO constellation will consist of 30
satellites in three orbital planes at an angle of 56 degrees to the equator. With the satellites taking about 14 hours to
orbit Earth at altitudes of 23 222 km, there will always be at least four satellites visible anywhere in the world1.
The IOV phase is the first of three incremental implementation steps or mission phases to develop the GALILEO
System and to validate its in-orbit performance. The Full Operational Capability (FOC) phase will deploy in full the
1
GCC-D Operations Training Manager, Operations Department, [email protected]
GCC-D Simulation Officer, Operations Department, [email protected]
3
LOCC-D Simulation Officer, ESA HSO-ONX, [email protected]
4
GCC-D Planning Engineer, Operations Department, [email protected]
1
2
ground and space infrastructure as required to achieve
full operational capability. The purpose of the final
Exploitation phase is to operate the FOC
infrastructure and to provide navigation services over
the entire system lifetime. The core system
components are the Space Segment (SSEG) including
launch services, the Ground Control Segment (GCS)
and the Ground Mission Segment (GMS). The GCS is
operated by the DLR Gesellschaft für Raumfahrtanwendungen (GfR) mbH as a company of the
German Aerospace Center DLR, having its seat at the
Galileo Control Center (GCC-D) in Oberpfaffenhofen. The GMS is situated in Telespazio’s Galileo
Control Center (GCC-I) in Fucino.
In addition to the ground segments, support
facilities have to be available as they are fundamental Figure 1. Predicted 3-dimensional view of the IOV confor the deployment, validation and maintenance of the stellation flight for an epoch on November 8, 2012 after
GALILEO system. Launch and Early Operations completion of the drift manoeuvre for FM3 and FM4
(LEOP) Control Centers (LOCCs) at CNES in
Toulouse and ESOC in Darmstadt are required for providing LEOP service for all satellites of the GALILEO
constellation. An In-Orbit Test (IOT) Station in Redu (B) is setup for providing a means to test the satellite functions
and performance after launch and separation.
The IOV constellation consisting of only 4 satellites will provide the capability of broadcasting globally a set of
navigation signals and other navigation data supporting a number of services. The IOV constellation depicted in Fig.
1 is thus the first step towards the final FOC constellation of 30 satellites. On October 21, 2011 the successful
launch of the first two GALILEO satellites Thijs (PFM) and Natalia (FM2) took place initiating the IOV phase. About
4 months later, the IOT campaign of both satellites was successfully accomplished at GCC-D.
The training of personnel for the first launch (L1) was based on a Training Need Analysis (TNA) provided by
the customer. The main objectives of the L1 simulation campaigns were to train and validate personnel for all
operational phases as well as to validate systems and interfaces. After the L1 IOT campaign, the training plan had to
be revised according to changing training needs and requirements imposing a more certification-based training
approach. The following section suggests a possible GCC training and certification process.
The described activities are carried out under a contract via Spaceopal GmbH within a program of and funded by
the European Union. The views expressed in this paper can in no way be construed as reflecting the official opinion
of the European Union and/or of the European Space Agency.
II. The Proposed GCC Training Process
To develop and propose an appropriate GCC training process several post-launch (L1) requirements have been
taken into account from which the most important ones are: (i) Changing task-, team- and role-based training needs,
(ii) Refresher or recurrent training for experienced and qualified engineers to maintain qualification/certification,
(iii) Possibility of cross- and re-certification, (iv) Flexibility regarding training methods and time slots to account for
changing resource constraints, trainee and trainer availability, (v) Assessment of trainees to measure their system
knowledge and qualification progress by means of written or verbal tests and assessment reports, (vi) Simulation
campaign as the last training method to validate, qualify or certify personnel for real operations, and finally (vii)
Trainers are assumed to have appropriate training skills and expertise in their training subjects.
Based upon these requirements, a multi-level training approach with three different training process entry levels
has been developed. The proposed process is depicted in Fig. 2. The core process starts with the Cat 3 trainee – new
employee – who has to go through the whole training curriculum from Level I to IV to achieve the required level of
skills and knowledge for certification. So-called training and simulation participation matrices assign roles and
trainees to Level I – III courses so that every candidate knows which course she or he has to take. Waivers may be
requested for certain training courses if the Cat 3 trainee can prove knowledge and/or former operations experience.
Recurrent and delta training as well as training for supporting teams like IT and network operations support is
captured by training side processes. If cross-certification is desired the Cat 1 trainee has to step in again on Level II
of the process. In case of cross-certification within the Flight Operations team the Cat 1 trainee can directly start
with Level III training. The process has to be re-started ~ 7 months prior to each launch assuming a training period
2
Figure 2. The proposed GCC multi-level training process with its three different training process entry
categories accounting for different training needs, system knowledge and operational experience of trainees.
The process is planned to be re-started ~ 7 months prior to each launch assuming a training period of ~ 6
months.
of ~ 6 months and 2 launches per year. In the following, scope and purpose of the training levels are described in
more detail.
Level I
Level I is the GALILEO system overview training with GCS and GMS introductory courses. It is applicable to all
newcomers regardless of their role and task. For this reason, Level I training shall be organized in a 3- or 4-day
block with theoretical presentations done by the trainers. This approach allows trainees to socialize with each other
and experts to refresh basic system knowledge. A multiple choice test has to be successfully answered for each
introductory course as qualification for the next training level. On-the-Job Training (OJT) already starts during or
after Level I training sessions and is continued throughout the training process. A training mentor creates a list of
tasks to be performed by the team. This list will be used to create a so-called score card in which the trainee’s OJT
tasks are scored. Each time an experienced engineer judges that the trainee is proficient on a task, that engineer signs
off the score on the trainee’s score card.
Level II
Level II is meant to be the operations specialist training consisting of task- and role-specific training courses for
GCS and GMS teams like the Flight, Ground and Mission operations teams. Level II training shall be done as selflearning combined with practical exercises. In case of multiple needs from trainees of different teams, a classroom
presentation can be setup. A multiple choice test has to be successfully answered for certification-relevant courses as
qualification for the next training level. Practical exercises will be assessed by the trainer, complemented by
discussion with the trainee team.
Level III
Level III is an intermediate training level devoted to the Flight Ops team only. This level covers satellite subsystem
training and is supposed to be done by self-learning. A subsequent verbal assessment by the training mentor will
qualify the trainee for the final simulation campaign. The trainee has to answer to a questionnaire with open
3
questions. Initial subsystem training will be provided by SSEG in case of a new satellite system. Subsequent
assessment is done by multiple choice tests provided by the manufacturer
Level IV
Level IV is the simulation training for final qualification and certification. The successful accomplishment of all
previous training levels is a prerequisite. The objective of this approach is to assess and certify system
knowledge/system matter expertise, to assess and certify operational skills and awareness for nominal and
contingency operations under realistic conditions. The simulation officer will assess the performance in a final
certification simulation related to specific objectives defined in the certification profile. The number of certification
simulations k and which simulation will be a certifying one depends on certification needs of personnel. The
assessment report is the most important reference for final evaluation in the Certification Board (CB) meeting. If a
trainee has failed her or his certification simulation the CB has to decide if the candidate has to do another
certification simulation or repeat the training starting from Level II (see Fig. 2).
A simulation campaign can also be seen as a main validation step of a mission operational validation approach.
The system simulator is the prime data source for ground segment validation testing, for staff training and for
exercising the complete ground system in a predefined series of simulations prior to launch2. The system simulator
is also required as a means of validating operational procedures. As already mentioned in the introduction, this
approach has been mainly applied to the L1 training and simulation campaign. However, FOC simulation campaigns
will have to focus on training and certification of personnel. Additional system and operational product validation
needs will be covered by delta training, i.e., delta systems and Flight Operations Procedure (FOP) validations
performed by qualified operations experts (see Fig. 2). For systems and FOP validation purposes, the simulation
officer normally setup dedicated validation simulations. For the L2 simulation campaign, it is planned to combine
training-relevant with validation-relevant simulations to keep up with the pace of the project. A training and
validation simulation can be further used to create training relevant S/C configurations for breakpoint generation.
That reduces the time effort to prepare simulations.
III. Simulation Planning and Execution Approach
LOCC and GCC simulation campaigns validate, qualify or certify trainees and teams for the satellite operational
phases shown in Fig. 3. The simulation plans provided by the simulation officers of each center prior to each
simulation campaign defines the total number m of
simulations, the scenarios
and the schedule required
to train and validate their
personnel. In case of a new
satellite system, the entire
Flight Operations team has
to be certified for opera- Figure 3. The GALILEO operational phases with single, dual- and multi-center
ting the new satellites, operations
meaning that Flight Ops
team members have to re-start the training process on Level III (see Fig. 2). The LOCC flight operation team needs
to be re-trained and re-validated for the critical LEOPs of the next launches as well, especially for L3 although
certification is not required.
The sequence for a simulation n within the simulation campaign is divided in three major phases: Phase I –
simulation preparations, Phase II – simulation execution and Phase III - simulation follow-up work. The flow or
process is presented in Fig. 4.
Phase I
In order to prepare a simulation the first step is to choose the simulation type. The following multi-control-centre
simulation types are considered:
1.
Joint GCC-D and IOT station simulations, also referred to as inter-site simulations
4
Figure 4. The applied simulation planning and execution sequence for a stand-alone or multi-control-center
simulation n with its three distinct phases: I – preparations, II – execution and III – follow-up work. The
simulation campaign is accomplished when the total number of planned simulations m is reached.
2.
3.
4.
Joint GCC-D and GCC-I simulation, also referred to as GCC inter-control-centre simulation
Joint LOCC and GCC-D simulation, also referred to as LOCC/GCC inter-control-centre simulation
Stand-alone simulation
LOCC simulations only consist of types 3 and 4 whereas GCC-D simulations consist of all types. GCC-I and IOT
station personnel is only remotely involved since these centres do not have their own simulators. Single-centre
operations are always trained through stand-alone simulations. Training for dual-centre operations considers standalone and inter-control-centre simulations. Platform (PF) commissioning scenarios are trained in stand-alone
simulations at GCC-D whilst LEOP scenarios are trained in stand-alone simulations at LOCC. Control handover and
special operations like the drift stop manoeuvre are typical scenarios for joint LOCC/GCC inter-control centre
simulations. The drift manoeuvre is started in LEOP. During the satellites’ drift to its target position within the
orbital plane the LOCC and GCC-D still exchange Flight Dynamics (FD) products until official FD handover after
Payload (PL) IOT. PL and secure IOT operations require multi-control-centre operations, thus the involvement of all
4 centres LOCC, GCC-D, GCC-I and the IOT station but not necessarily at the same time. Training is therefore
performed through alternating inter-site or inter-control-centre simulations. Routine contact scenarios are trained in
the framework of GCC inter-control-centre simulations, thus as a joint GCC-D/GCC-I simulation.
Every simulation type requires pre-configurations and definitions, i.e., a scenario description, general
information, initial spacecraft (S/C) and environment configurations, participating trainees and teams, ground
elements and infrastructure setup as well as an activity timeline. S/C systems and environment are configured on the
simulator by the simulation officer and saved as a so-called “breakpoint” that is a huge data vector containing the
status of all modelled parameter for a certain simulated epoch. The detailed Sequence of Events (SoE) is created by
the planning team based on the simulation plan provided by the simulation officer. The SoE mainly lists all events
and activities to be executed for a satellite in a chronological order and with procedure references. The overall
timeline can then be visualized in the training or control room as a Gantt chart, also highlighting ground station
visibilities and contact durations. The entire configuration is described in a simulation book at GCC-D and in a
briefing note at LOCC. In case of a contingency simulation, the simulation officer has to define failure cases and to
eventually test them on the simulator. To do so she or he restores the breakpoint, sets the simulator in run mode and
injects available failure commands and tests them especially regarding Failure Detection, Isolation and Recovery
(FDIR) reactions.
About 7 days prior to starting the simulation session, the simulation officer releases the simulation book or the
briefing note and invites the participating personnel. In case of multi-control-centre simulations, a joint simulation
book or briefing note is the preferred solution. About 2 days before simulation start, the simulation officer checks
the initial S/C configuration together with Flight operations team member and trainees by restoring the breakpoint
and setting the simulator in run mode. In case of deviations, the simulation officer adjusts the breakpoint and saves it
again. Typical deviations are missing TM packets or a wrong S/C unit configuration.
5
Phase II
The simulation day normally starts with the setup and configuration of the simulator for which the support of the
ground team is required. Especially for time-tagged commanding in routine contact or manoeuvre simulations the
system time has to be synchronized with the simulated epoch which is normally in the future. This requires a time
configuration of the S/C monitoring and control system. Meanwhile, the training room infrastructure is configured
by the hosting team to display the Gantt chart, S/C monitoring and control events and times on special screens. A
short briefing is done in the training room in which the simulation officer briefly describes scenario, training
objectives, important events and the initial S/C configuration. In case of multi-control-center simulations, a joint
briefing is performed on the corresponding voice loop. After the briefing, the trainees prepare their consoles for the
simulation. At T0, the simulator is set in run mode and the start of the simulation is announced via the operations
voice loop. After simulation end, the simulation officer normally invites the team to a de-briefing to discuss
observations, simulated or real anomalies, change requests and learning effects.
Phase III
The follow-up work is to analyse all raised observation reports, change and planning requests. These reports and
requests are tracked in the anomaly tracking tool in which special GCC projects are available for simulation and
training purposes. Based upon the simulation observations reports, planning and change requests as well as
debriefing and personal notes, the simulation officer writes and releases the simulation report containing the
performance assessment of trainees and teams w.r.t. training and certification objectives.
In the following section, the configuration of the LOCC/GCC inter-control-centre simulation will be explained in
more detail since the control handover is considered as a critical phase in which satellites are handed over from one
control entity to another one and requiring a special setup.
IV. The joint LOCC-GCC Control Handover Simulation
In order to handover the control of a spacecraft from LOCC to GCC in a controlled and well-structured way the
handover phase has been split into the following sub-phases: (i) pre-handover, (ii) handover and (iii) post-handover
phase. The handover of a spacecraft from LOCC to GCC has always to take place in a joint pass that ensures that
both control centers have adequate duration, visibility and access to the spacecraft to complete the handover
activities. The pre-handover phase is devoted to joint FD activities like orbit determination whereas in the main
handover phase the GCC-D flight ops team takes over responsibility by sending first test and up-linking timetagged commands via the GCS ground stations. The handover phase is formally accomplished when the GCC-D
operations director signs
off a formal handover
report sent by the LOCC
operations director. The
purpose of the posthandover phase is to
archive the entire LEOP
Telemetry (TM) and Telecommand (TC) history provided by LOCC.
The main objectives of
the control handover simulation were to exercise the
interfaces between the
different teams, especially
between the flight operations and the FD teams,
and to validate operational Figure 5. Sketch of the proposed network setup for an inter-control-center
interfaces and handover simulation in which one simulator sends real-time TM data to the S/C controlling
operations. Interfaces are workstations of both centers and receives real-time TC data coming from both S/C
required for (a) real-time controlling workstations
6
TM and TC data transfer between LOCC and GCC, (b) near real-time TM flow from GCC to LOCC realized by
rapid file transfer, (c) FD data transfer from LOCC to GCC and (d) voice communication links. Rapid files contain
chunks of recorded TM. To transfer orbit information from LOCC to GCC and rapid files back to LOCC the
standard GALILEO data distribution network is used. For verbal communication between both centers dedicated
loops of the voice communication system are used. To train and validate all these interfaces as well as the handover
operations in a joint LOCC/GCC inter-control-center simulation the following constraints had to be taken into
account: Starting with identical initial S/C and thus breakpoint conditions, choosing a site in which GCS and LEOP
ground stations are very close to each other, and finally having an uninterrupted simulation run.
The requirement to transfer TM and TC frames in real-time and the other constraints imposed a special network
setup between LOCC and GCC-D in which only one simulator shall run the entire simulation. The simulator has to
send TM packets to the S/C monitoring control systems of both centres and has to receive TC packets coming from
both S/C control systems. Due to technical constraints and time synchronization issues the LOCC simulator had
been selected to run the joint simulation which required a re-configuration of the LOCC simulator such that it is able
to also model the selected GCS ground stations. The GCC-D S/C controlling system time had to be synchronized
with the LOCC S/C controlling system time running in the future. Fig. 5 depicts a sketch of a possible network setup
required for inter-control-centre simulations. To send simulated TM and receive TC packets to and from GCC-D the
LOCC simulator is connected via a so-called network control server to the data handling server in the GCC-D
training room where they are parsed or assembled. From there TM annotations, TM messages and TC
acknowledgements are unidirectional forwarded to a proxy server whilst TM and TC frames can only be routed bidirectional through a security element to and from the proxy server.
An alternative would have been a setup in which the GCC-D simulator takes over the control of the simulation
for example after the handover phase or even earlier. This would have implied a short stop of the simulation, saving
the breakpoint, sending it to GCC-D, restoring it on the GCC-D simulator and re-configuring the GCC-D S/C
monitoring and control system. This approach was deemed to be too risky and would cause an inacceptable
interruption of the simulation. However, it was deemed to be very useful for the stand-alone PF commissioning
simulations at GCC-D since the saved and transferred LOCC handover breakpoint allowed a seamless continuation
of further stand-alone PF commissioning simulations at GCC-D using the handover breakpoint as the initial PF
commissioning breakpoint.
V. Lessons Learned and Simulation Advancements
During the first IOV PF commissioning phase, a L1 simulation campaign retrospective meeting took place at
GCC-D to discuss lessons learned together with operation leaders, hosting engineers and simulation officers. This
section summarizes lessons learned from real operations having an impact on the definition and configuration of
future IOV and FOC simulations.
Integration of operationally used SoEs
L1 simulation timelines were derived from preliminary operations plans with rough activity descriptions. Some
activities could not be trained since operation procedures were still not available. The planning team manually
created a SoE based on the simulation plan and used a simple Gantt chart tool to visualize the SoE as described in
chapter 3. After entering to the routine phase for PFM and FM2, SoEs are now available that define proved
operation activities for both S/Cs starting from control handover up to routine phase. These timelines will be used to
define timelines for future IOV and FOC simulations making them more realistic.
Constellation flight operations concept
Nearly all L1 simulations were run with only one S/C. Current IOV operations already require the execution of
parallel activities for PFM and FM2. E.g., after the control handover of the second satellite, reduced routine
operations already had to start for the first satellite indicating that a full IOV and future FOC flight constellation will
have overlapping operational phases and the requirement to execute many activities in parallel. Discussions of
lessons learned gained from constellation operations of other missions state the training need for constellations
flights with multiple S/Cs3. To setup an advanced IOV constellation simulation the L2 simulation timelines will
have to consider constellation flight scenarios with 2 or even 4 S/Cs. A constellation simulator is available for the
L2 simulation campaign.
7
Figure 6. Gantt chart visualizing a proposed timeline for an advanced inter-control-center IOV simulation in
a dual-spacecraft constellation flight to train control handover and routine contact operations in parallel
Multi-control-center operations concepts
The GALILEO mission operations concept requires single-, dual- and multi-control-center operations to execute joint
activities in the different operational phases. Many of these activities and operational interfaces have been validated
in the L1 simulation campaign in the framework of the operational validation concept as described in chapter II and
are being proved in the on-going IOV mission phase. In a current human space flight mission personnel are trained
and certified in various joint simulations showing that multi-control-center training and operations is a state-of-theart approach4. However, a constellation flight simulation in an inter- or multi-control-center environment will further
advance the level of IOV simulations regarding FOC operational requirements. Fig. 6 proposes a dual-spacecraft
constellation scenario for an advanced inter-control-center IOV simulation to train control handover and routine
contact activities in parallel.
Contingency operations
In the L1 contingency simulations typical failures like TM loss, reaction wheel friction, heater line outage or a Save
Mode drop were triggered to train awareness and skills for recovery operations. In real operations network problems
occurred where the training had not been provided to support recovery actions. Future IOV and FOC simulations
will have to consider more hosting and infrastructure failures to better prepare and qualify operations and hosting
teams for real contingency operations.
Automation for constellation operations
A high degree of automation and autonomy is achieved using a number of novel tools that are integrated into a
coherent ground system to perform all required operations functions3. In the area of routine task execution, a new
multi-control-center mission planning approach will be applied in the near future to make use of automation
capabilities for command sequence generation and SoE execution5. The GCC planning facility will regularly create
so-called Short-Term-Plans (STP) based on a planning data base containing activity definitions and rules like ground
station visibilities. The planning facility will then send the STP to the S/C monitoring and control system that
automatically generates all required command sequences for all activities to be executed during the different
contacts. To create the command sequences the S/C control system refers to an internal procedure file archive. This
automated approach can be used to prepare and execute any future stand-alone or multi-control-center simulation:
The planning facility in the training room will create a STP-based SoE for simulation purposes based on activity
8
information provided by the simulation officer. It is assumed that the simulation timeline will always deviate slightly
from the real operation timelines stored in the planning database because operational products might not be available
or due to other resource constraints. The planning facility will then send the training STP to the S/C monitoring and
control system in the training room that automatically generates the command sequences for the simulation. The
current approach is that a S/C controller, a S/C operations engineer or a trainee has to manually create the command
stacks at the S/C monitoring and control system based on the provided STP-based SoE.
Inter-control-center communication
It has been experienced that in the first control handover and in the early post-handover operational phase
communication ways and methods were not elaborated. Future inter- or multi-control-center simulations and
operations require clear and documented communication rules.
VI. Conclusions
It has been demonstrated that the proposed GCC training process accounts for the evolving training needs and
resource constraints within the IOV mission phase. Simple certification guidelines have been presented which can
be implemented in the L2 training process on a very cost-effective basis. Training relies on highly skilled and
experienced trainers and training mentors being involved in real operations so that the recruitment of external
personnel is not required.
Combining purely training- and certification-based with validation-based simulations as a merged simulation
concept seems to be the preferred solution for the fast pace of the project. The merged concept expresses the IOV
specific transition from a validation- to a certification-based simulation approach.
The proposed timeline for the advanced inter-control-centre simulation includes overlapping operations phases
and parallel activities for two satellites making IOV simulations much more realistic and advanced w.r.t.
constellation flight and multi-control-centre operations. The configuration of the presented control handover
simulation can be used as a valuable reference for the setup of any other multi-control-centre simulation.
Future contingency simulations will have to consider more network and infrastructure failures to better prepare
and qualify operations and hosting teams for real contingency operations.
Utilizing the nearly automated command sequence generation approach will make the preparation of future
stand-alone and multi-control-centre simulations much more time- and cost-effective and clear communication rules
will optimize inter-control-centre communication during joint simulations and operations.
Appendix A
Acronym List
CB
CNES
DLR
ESOC
FD
FDIR
FM
FOC
FOP
GCC
GCS
GfR
GMS
GNSS
GST
ILS
IOV
IOT
LEOP
LOCC
Certification Board
Centre National d’Etudes Spatiales
Deutsches Zentrum für Luft- und Raumfahrt
European Space Operations Centre
Flight Dynamics
Failure Detection, Isolation and Recovery
Flight Model
Full Operational Capability
Flight Operations Procedure
Galileo Control Centre
Ground Control Segment
Gesellschaft für Raumfahrtanwendungen
Ground Mission Segment
Global Navigation Satellite System
Galileo System Time
Integrated Logistic Support
In-Orbit Validation
In-Orbit Testing
Launch and Early Orbit Phase
LEOP Operations Control Centre
9
OJT
PF
PFM
PL
S/C
SLE
SoE
SSEG
STP
TC
TM
TNA
On-the-Job Training
Platform
Proto Flight Model
Payload
Spacecraft
Space Link Extension
Sequence of Events
Space Segment
Short-Term Plan
Tele-command
Telemetry
Training Need Analysis
Acknowledgments
The authors would like to thank the customers ESA and Spaceopal and the entire GfR team for helpful
contributions and comments. Fig. 1 has been created using the commercially available AGI Satellite Tool Kit
software V9.0.
References
1
Kuhlen, H., Galileo Satellites, In: Handbook of Space Technology, 1st ed., John Wiley & Sons, Ltd, 2009, Chap. 8.6.
2
Warhaut, M., Spacecraft Operations, In: Handbook of Space Technology, 1st ed., John Wiley & Sons, Ltd, 2009, Chap. 6.1.
3
Bester, M., Lewis, M., Roberts, B., et al., “Ground Systems and Flight Operations of the THEMIS Constellation Mission,”
Aerospace Conference [online journal], URL: http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4526662&tag=1 [cited 25
April 2012]
4
Sabath, D. and Kuch, T., Operations for Human Space Flight, In: Handbook of Space Technology, 1st ed., John Wiley &
Sons, Ltd, 2009, Chap. 6.4.
5
Brajovic, J., and Fischer, H.-J., “The Challenges of a Multi-Control-Centre Mission Planning,” Space Operations
Conference, IAAA, Stockholm, 2012
10
